nerlo-skill-scanner — behavioral

Nerlo-original

Nerlo-original behavioral detection — the postmark-mcp backdoor shape.

What it scans

Acquired source across every distribution surface — git source, GitHub release assets, npm tarball, pip wheel — reading it statically inside a sandbox that never executes untrusted code. The behavioral component parses JS/TS and Python.

What it catches

Obfuscated decode-then-exec — code that base64/hex-decodes a blob and immediately runs it.
Dynamic eval/exec of runtime-constructed strings.
Hardcoded exfiltration — credentials or data read and shipped to a hardcoded destination.

The FakeGit story

In the FakeGit/SmartLoader campaign, roughly 800 fake MCP-server repositories cloned a legitimate Oura Ring MCP server. The tracked git source was clean. The payload — an obfuscated LuaJIT dropper that staged into SmartLoader and then StealC — shipped as a GitHub release asset, and the README quietly told the user to run it.

A scanner that only reads the tracked source returns Verified and is wrong. That is the class of attack the behavioral detector is built to catch on the surface where the payload actually lives: the acquired release asset, read statically alongside the source.

Live detection demo

We publish a benign public canary — a defanged FakeGit-shaped repository carrying no working payload — so anyone can watch Nerlo flag it Unsafe for the right reasons. The canary lives at github.com/nerlo-ai/nerlo-canary-fakegit. These are the validated findings from that scan:

Release-asset resource.jsUnsafe

Obfuscated decode-then-exec (ERROR) — a decoded blob is executed at runtime.

Clean decoy sourceVerified

No findings — the tracked source is clean by design.

Why this matters

The behavioral finding lands on the release asset, not the git tree. A git-source-only scan reads the clean decoy source, finds nothing, and calls the artifact Verified.

Acquiring and scanning the GitHub release asset is what surfaces the decode-then-exec payload. That is why Nerlo scans every distribution surface rather than trusting the repository's main branch.

See the same lesson generalized across every distribution surface in the scoring methodology.

Source and provenance

Nerlo pins and publishes each scanner's provenance so you can verify it yourself. Every scan surfaces the source, version, and install command in its report.

Kind: Nerlo-original
Source channel: Nerlo-original (built in-house)
Pinned version: shipped in the deployed scanner image
License: Nerlo
Source URL: https://github.com/nerlo-ai/nerlo-canary-fakegit